[bawolff]

It seems pretty unlikely that selling a zero-day to a state actor is a violation of international law, unless the vendor knows that state actor intends to use it to commit an internationally wrongful act.

Like at the very worst - selling "cyberweapons" would follow the same rules as selling actual weapons.

I don't super follow US politics, but i don't think we are at the point where ICE is comitting crimes against humanity - which i think is what would be required for this transaction to violate international law.